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APPENDIX A: Sample ODF file 

5 <?xml version="l . 0" encoding="utf -8"?> 

<!-- serviceMonitor is the name of the configuration. The entire 
configuration may be enabled or not 

the revision SHOULD be modifed EACH time ANY changes are performed 
to the configuration. The version 
10 should remain constant. 

- - > 

< serviceMonitor 

xmlns="http : //www. serviceintegrity . com/ serviceMonitor/rulesDef inition.xm 
1" version="l" enabled= "true " revision="22 "> 
15. <!-- this is where we will stick config information that tells us 

how to behave in general --> 
<conf iguration> 

<!-- Sampling says that only look at every nth operation. 
This is useful if your server gets a 
20 ton of traffic and the things you are asking us to do 

would slow down the server if done on 
each request --> 
<sampling>5</sampling> 

<!-- logFlushlnterval indicates how often to flush buffered 
25 output files. Any open buffered 

file will be flushed every logFlushlnterval seconds. 
If this value is 0, the files will 

never be flushed. The default value is 15. --> 
< logFlushlnterval >15</ logFlushlnterval > 
30 <!-- Required attribute, contains the license of the product 

- - > 

<licenseKey>TEST-20101231- 
1 5 Cp / +bNh3 7Hn j W/ z ApkrDTnhVS = </ license Key > 

<!-- reapAfter specifies the minimum number of days that an 
35 orphaned log (directory) will be 

left before we reap it. The filter will remove any 
sub-directories under the log base 

that are not owned by a log and have not been touched 
for a least reapAfter days . 
40 Default is 0, which means that the feature is disabled 

- - > 

<reapAf ter>l</reapAf ter> 

<!-- logErrorlnterval specifies how often to log parse 
errors on incoming requests in seconds. 
45 The default value (3600) indicates that a message 

indicating that there have been 

parse errors on the server will be logged no more often 
than once an hour. 



3598784vl 



81 



CHS Ref. No.: SIS-00101 



A value of 0 indicates that all parse errors are to be 
logged to the system event 

log. Any value greater than or equal to 0 is allowed, 
and specifies in seconds how often 
5 to log parse error on incoming requests --> 

<logErrorInterval>3600</logErrorInterval> 
</ conf iguration> 

<!-- formats section is used to defined all format definitions 

a format definition tells us how to write a variable to the 
10 output device 

In one embodiment, there are 2 kinds of formats: string and 

timestamp 
- - > 

<f ormats> 

15 <!-- string format allows the user to define the following: 

1) formatting 

fieldWidth (0+) : the minimum number of spaces to 
take up for this field (0 means no limit) 

maxLength (0+) : the maximum number of characters to 
20 print (0 means no limit) 

justify (left or right) : whether to justify the data 

to the left or right 

2) transforms 

replace: replace all instances of the string in 
25 "from" to the string in "to" 

trim: truncate all leading and trailing whitespace 

(" " , "\t", "\n") 

encryption: encrypt this field using the given 
algorithm, password in keyFile and output 
30 using the encoding defined in "format" 

singleLine: replace all new lines in the field with 

spaces 

encodeXml : encode according to xml encoding 

definition 

35 encodeBase64 : encode according to the base64 

encoding definition 
- -> 

<string name="PrivateString" > 
< trans forms > 

40 <encryption algorithm="aes" keyFile=" ticket .key" 

format="base64" /> 

</transf orms> 
</string> 

<string name="SecretString" > 
45 <transforms> 

<hash algorithm="md5" f ormat="base64" /> 
</transf orms> 
</string> 

<string name="StringlOO"> 
50 formatting f ieldWidth="100" maxLength="100" 

justify="left" /> 

<transf orms> 

<replace> 

<f rom>\t</f rom> 
55 <to> </to> 
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</replace> 
<trim/> 
<encodeXml/> 
<singleLine /> 
5 </transf orms> 

</string> 

<string name="EncodedlOO"> 

formatting f ieldWidth="100" maxLength="100" 

justify="left" /> 
10 <transf orms> 

<encodeBase64/> 
</transf orms> 
</string> 

<!-- timestamp format expects that it will get an integer 
15 that specifies time as the number of 

seconds since EPOCH (this means January 1, 1970 GMT) 
The output definition we use uses the format 
specification defined by strftimeO 

This says that %Y is equivalent to 4 digit year (i.e. 

20 2002) and so on 
- - > 

<timestamp name="Timeformat">%Y-%m-%d %H : %M : %S</timestamp> 
</f ormats> 

25 <!-- Fields allow you to define expressions that you are going to 

use in either conditions or 

output. For example lets say that I am interested in 
printing the available credit for 

each customer, but all I see in the request is the total 
30 credit and the outstanding balance. 

I then define an expression "Credit" that is TotalCredit - 
Balance. Now I can print Credit 
when I want to 

- - > 

35 <fields> 

<!-- The expressions supported in fields and conditional 
expressions are: 

add - numeric addition 

sub - numeric subtraction 
40 div - numeric division 

mult - numeric multiplication 

mod - numeric modulo (%) 

eq - string, numeric, boolean equality 

ne - string, numeric, boolean non-equality 
45 It - numeric less than 

le - numeric less than or equal 

gt - numeric greater than 

ge - numeric greater than equal 

sit - string less than 
50 sle - string less than or equal 

sgt - string greater than 

sge - string greater than or equal 

match - regular expression match (i.e. foo match 

f [oO]+) 

55 and - boolean 
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or - boolean 

not - boolean unary negation 
exists - unary 

- - > 

5 <f ieldDef inition name="TotalBytes 11 type=" integer" > 

<add> 

<!-- Fields, conditions and output elements can 
be of the following types: 

serverVariable : (i.e. HttpStatus, Duration, 

10 Timestamp) 

header: HTTP header (i.e. Host, Referer) 
element : xml element 

soapOperation: the name of the soap request 
soapParmeter : a parameter in the soap 

15 request 

soapFault: the fault (error) from the soap 

request 

literal: a constant value 
field: user defined expression 

20 

<serverVariable name= "BytesSent"/> 

< serverVariable name="BytesReceived"/> 

</add> 
</f ieldDef inition> 
25 </fields> 

<!-- Destinations are the output mechaninsms available to the 

filter 

Currently the types of output mechanisms supported are: file 
(file system) , event (event log) 

30 

destinations > 

<!-- Files must have a name, the path to the file written is 
determined by the filter using the 

directory attribute in the config section and the name 
35 attribute designated here. 

Optionally they may also specify whether to flush the 
output on each write (by default false) 

and whether they are enabled (default true) . Finally 
users may specify the maximum size (in megabytes) 
40 that a file is allowed to read. If a file reaches that 

limit, the file will either be rolled over 

(if rollover is enabled) or rewound to the beginning, 
(default 0, no limit) 
- - > 

45 <file name ="Errorlog" enabled="true" autoFlush=" false" 

maxSize="2 00"> 

<!-- Files support an optional rollover specification 
that allows the user to define when and where 

to rollover the file. Rollover supports the 

50 following options 

interval [0] : (seconds) how often to roll over 
(i.e. 86400 means every day). If this attribute is 0, there will 

be no time-based rollover. 

startTime [0] : (seconds) when to roll over. The 
55 time from which we start counting interval. (i.e. 
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an interval of 86400 (24 hours) and a startTime or 
7200, means we will roll the file 

every day at 2:00 AM) 

enabled [true] : whether the rollover is in use or 

5 not . 

backup [false] : whether to write log entries to the 
backupDirectory if it is unable to write 

them to the normal file (i.e. out of disk) 

10 The name of the rollover files is based on the 

configuration element's directory element, 

the file element's name attribute and the date/time 
at which the file was created and rolled over. 
- -> 

15 <!-- <rollover enabled="true" startTime="7200" 

intervals "864 00" backup="true"> --> 

<rollover enabled="true" startTime="7200 " 

interval="86400"> 

<!-- Rollover support an optional copies element 
20 that allows the user to define attributes of 

the rolled over files. Copies supports the 

following options 

totalsize [0] : (megabytes) the maximum 
(appoximate) amount of disk space that all rolledover 
25 files can take. 

zipLevel [1] : (number 0-9) the level of 
compression to apply on the log 

discardAfter [0] : (secodns) the maximum 
number of seconds that a rolled over log will be allowed to 
30 remain before we reap it. After the 

specified number of seconds the log may be reaped (deleted) 

even if the log does not exceed it 

totalsize 

- - > 

35 <copies totalSize="1000" zipLevel= " 1 " 

discardAfter= "12 09600 "/> 

</ rollover> 

<!-- Delimited output suppport is provide through the 
optional "delimited" element. 
40 This element indicates that output file generated 

will contain delimiters in between fields and 

records . Any occurence of the one of the 
delimiters in the actual data will be "escaped" by 

another delimiter. The default delimiters are 
45 "|" (pipe) for field, "\n" (new line) for record and 

"\\" (single backslash) for escape. The defaults 
may be overloaded by the element attributes 

record, field and escape. The value of these 
attributes must be the sequence of characters of the 
50 delimiter in hexadecimal notation. For example 

if the field delimiter should instead be a sequence 

of two tabs, the element specification should be 
<delimited f ield="0x090x09"/> . 

The element delimited supports the following 

55 attributes: 
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field [0x7c] (pipe ' | ' ) : the separator between 
fields, this separator will appear after EVERY field in a record 

written to a delimited log 

record [0x0a] (new line '\n'): the separator 
5 between records, this separtor will apper after EVERY record 

immediately following the last field delimiter 
escape [0x5c] (backslash '\'): the escape 

delimiter, this delimiter appears once before each instance of a 

delimiter 

10 (field, record or escape) in the actual log data. 

The escape delimiter MUST be only one character long. 

Note that delimiter may consist of more than one 
character, and that they may contain non-printable 

characters. Delimiters may not start with 
15 another delimiter (i.e. f ield=" 0x0a09" is invalid if record="0x0a") 

— > 

<delimited field="0x7c" record="0x0a" escape="0x5c"/> 
</file> 

<!-- Event log entries also must have a name. They may 
20 specify a severity (Error, Warning, Information, 

AuditSuccess, AuditFailure) , application (name that 
will show up in event log) , server (the 

name of the host where the event will be logged ... if 
omitted then event are logged locally) 

25 

Like files, you may have multiple event entries (i.e. 
you may wish to have one to log warnings, 

another for errors etc) . Like file, the event 
destination may be enabled or disabled 

30 

<event name =" Event log" enabled="true" severity= "Error" 
application="Test" server="" /> 
</destinations> 

<!-- rules define what to log, where to log it and when to do it. 

35 --> 

<rule name="Errorlogger" enabled="true"> 

<!-- Each rule may have 0 or 1 conditions. The condition is 
an expression that must evaluate to 

true if the rule is to produce any output for this 
40 message. As stated before, the expression 

can consist of the logical, lexical and arithmetic 
expressions described above combined to 

result in a single boolean result 

- - > 

45 <condition> 

<and> 

<eq> 

<!-- headers indicate an HTTP header. The 
header definition must include the name 
50 and the direction (input | output) 

- - > 

<header direction=" input" name="Uri"/> 
<!-- Literals define a constant --> 
< literal >Accounting/Servicel</literal> 

55 </eq> 
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<or> 

<!-- exists indicates that the following 
expression is defined in the message --> 

<exists> 

5 <!-- element is an xml element. The 

xml element must include a name which is the 

combination of all ancestor 

elements separated by spaces. 

- - > 

10 <element 

name="http : \/\/schemas .xml soap . org\/soap\/envelope\/ : Envelope" 
direction="output" /> 

</exists> 
<ge> 

15 <literal>40</literal> 

<add> 

<serverVariable 

name="BytesReceived" /> 

<serverVariable 

20 name="BytesSent" /> 

</add> 

</ge> 

</or> 

</and> 

25 </condition> 

<!-- Output defines an individual output specification. 
There must be at least 1 output specification 

in each rule. Each output must include a reference to 
30 a destination (defined above) and 1 or 

more expressions for output. The output will submit 
all the expressions provided in order to 

the destination specified for processing 

- - > 

35 <output destination= "Eventlog" enabled="true"> 

<literal>Error </literal> 

<serverVariable name="Status" displayName="Status"/> 
<literal> processing request from: </literal> 
<serverVariable name= "ClientUserName" /> 
40 <literal>, </literal> 

<!-- soapParameter is another form of expression that 
defines a parameter in the soap request 

soap parameters require a name (like element) , 

and a direction. 

45 

< soapParameter name=" /Transactionld" direction=" input" 
displayName=" Transaction" /> 

<literal>: </literal> 

<field name="TotalBytes" displayName= "Bandwidth" /> 
50 <literal>\t</literal> 

<!-- all expressions in an output section (except for 
literal) may include a reference to a 

format specification. This specification will be 
used to alter the appearance of the 
55 result prior to submission to the destination 
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- - > 

<soapParameter name= " /Payment/Balance " 
direction=" input 11 f ormat="PrivateString" /> 

<soapParameter name=" /Account /Nanme" direction=" input" 
5 f ormat="SecretString" /> 
</ output > 

<!-- outputs may also be disabled individually --> 
<!-- Each output in a rule may contained a completely 
10 different list of expressions --> 

<output destination="Errorlog" enabled="true"> 

<serverVariable name="Timestamp" f ormat="Timeformat" 

/> 

<literal>: Error </literal> 
15 <serverVariable name= "Status " /> 

<literal> processing request from: </literal> 
<serverVariable name="ClientUserName" /> 
<literal>, </literal> 

<soapParameter name="/TransactionId" direction=" input" 
20 format="StringlOO"/> 

<literal>. Details: </literal> 
<soapOperation displayName= "Operation" / > 
<literal> : </literal> 

<soapFault name="/" format="StringlOO" 
25 displayName="Error"/> 

<literal>\nFull message : \n</literal> 
<rawData direction=" input" kind="xml" 
displayName=" Input"/ > 

<literal>\n\n</ literal > 
30 </ output > 

</rule> 
</serviceMonitor> 
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APPENDIX B: Description of XML elements of an ODF file 
add Element 

The add element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list expressions to be added together. The add 
element requires 2 expressions that evaluate to a number. 



Start Element 


End Element 


Attribute Required 


Attributes 


<add> 


</add> 


N/A 


(None) 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 

The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the errorfrom the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



Attributes: None 
10 Sub Elements: 

May be used 0- 2 times: 
<serverVariable> 
Duration, Timestamp) 

<header> 
1 5 <element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

20 <field> 

<rawData> 
request is to be logged. 

Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
25 Examples: 

The following example adds together the server variable named BytesSent and the server 
variable named BytesReceived, and returns the result: 

<add> 

. < serverVariable name="BytesSent" type="int"/> 
30 <serverVariable name="BytesReceived" type="int"/> 

</add> 

The following example multiplies the soapParameter named Earnings PerShare and the 

soapParameter named Shares, and adds the result to Dividendslncome: 
35 <add> 

<mult> 

<soapParameter direction="output" name="EarningsPerShare" type=" int"/> 
< soapParameter direction= "output" name="Shares" type="int"/> 
</mult> 

40 <soapParameter direct ion=" output" name= "Dividendslncome" type="int"/> 

</add> 



and Element 
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The and element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list conditions which must all be met. 



Start Element 


End Element 


Attribute Required 


Attributes 


<and> 


</and> 


N/A 


(None) 



10 



15 



20 



25 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 



<serverVariable> 


The 


Duration, Timestamp) 




<header> 


The 


<element> 


The 


<soapOperation> 


The 


<soapParameter> 


The 


<soapFault> 


The 


<literal> 


The 


<field> 


The 


<rawData> 


The 


request is to be logged. 





The serverVariable element indicates a server variable (e.g., HttpStatus, 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example checks to see if the values of foo and bar are both true. If so, the 
condition is met, and true is returned: 

<and> 

<field name="foo" >true</f ield> 
<field name="bar">true</f ield> 
</and> 



30 condition Element 

The condition element, an optional sub element of rule, is an expression that must 
evaluate to true if the rule is to produce any output for this message. The expression can 
combine any of the logical, lexical, and arithmetic expressions described throughout this 
section; and must produce a single Boolean result. 

35 



Start Element 


End Element 


Attribute Required 


Attributes 


<condition> 


</condition> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

May be used 0-1 times: 
40 <add> The add element is for numeric addition 

<sub> The sub element is for numeric subtraction 
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<div> The div element is for numeric division 

<mult> The mult element is for numeric multiplication 

<mod> The mod element is for numeric modulo (%) 

<eq> The eq element is for string, numeric or Boolean equality 

5 <ne> The ne element is for string, numeric or Boolean inequality 

<lt> The It element is for numeric less than 

<le> The le element is for numeric less than or equal to 

<gt> The gt element is for numeric greater than 

<ge> The ge element is for numeric greater than or equal to 

1 0 <slt> The sit element is for string less than 

<sle> The sle element is for string less than or equal to 

<sgt> The sit element is for string greater than 

<sge> The sle element is for string greater than or equal to 

<match> The match element is for regular expression matches 

1 5 <and> The and element is for Boolean add 

<or> The or element is for Boolean or 

<not> The not element is for Boolean unary negation 

<exists> The exists element is unary 



20 configuration Element 



The configuration element, an optional unique sub element of serviceMonitor, 
demarcates the start and end of a block of information dictating the behavior of the 
service. The only configuration sub elements currently supported is sampling. 



Start Element 


End Element 


Attribute Required 


Attributes 


<conf iguration> 


</conf iguration> 


N/A 


(None) 



25 

Attributes: None 
Sub Elements: 

May be used 0-1 times: 

<sampling> sampling indicates how often operations should be sampled. 

30 <logFlushInterval> logFlushlnterval shows the number of seconds to wait before flushing 

file destinations that do not have autoFlush turned on or a zero buffer size. 

copies Element 

The copies element, an optional sub element of rollover, specifies where and when the 
35 log file should be rolled over 



Start Element 


End Element 


Attribute Required 


Attributes 


< copies > 


</copies> 


No 
No 


totalSize 
zipLevel 
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Attributes: 

totalSize: 

totaisize represents the maximum disk space, in megabytes, that all rolled-over files 
5 may take cumulatively. Older files will be removed when this limit is reached. If a new 

rollover copy would exceed this limit, the oldest files will be removed until there is either 
a single copy left, or disk usage is below the specified threshold. The default value, 0, 
indicates that older files will never be deleted by the application. The value of totaisize 
must be a positive integer. 

10 

zipLevel : 

zipLevel indicates the compression level that will be applied to rolled-over versions of 
the log. Acceptable values range from 0 to 9. The default value of 1 indicates that fast 
compression will be performed. 

15 

Example: <copies totalSize="1000" zipLevel="0" /> 
Sub Elements: None 

20 Note: Currently the attribute zipLevel is ignored by the parser. All logs are written uncompressed onto 
disk regardless of the value of zipLevel 

delimited Element 

25 The delimited element, an optional sub element of file, indicates that the output file 

generated will contain delimiters between fields and records. Any occurrence of one of 
the delimiters in the actual data will be "escaped" by another delimiter. Default 
delimiters are "|" (pipe) for field, "\n" (new line) for record and"\" (single backslash) for 
escape. The defaults may be overloaded by the element attributes record, field and 

30 escape. The value of these attributes must be the sequence of characters of the delimiter 
in hexadecimal notation. For example if the field delimiter should be a sequence of two 
tabs instead of the default pipe, the element specification should be <delimited 
field="0x090x097>. 



Start Element 


End Element 


Attribute Required 


Attributes 


<delimited> 


</delimited> 


no 


field 






no 


record 






no 


escape 



35 

Attributes: 

field [0x7c] : 

The separator between fields, this delimiter will appear after EVERY field in a record 
written to a delimited log. The field delimiter may consist of more than one character. 

40 

record [0x12] : 

The separator between records, this delimiter will appear after EVERY record 
immediately following the last field delimiter. The record delimiter may consist of more 
than one character. 



escape [0x5c] : 
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The escape delimiter, this delimiter appears once before each instance of a delimiter 
(field, record or escape) in the actual log data. Note that the escape delimiter can only be 
one character long. 

Example, with the values set to defaults: 

<delimited field="0x7c" records "0x12" escape="0x5c" /> 



10 Note that no delimiter may start with the same character(s) as another. (So <delimited 
field="0xAA" record="0xAA0xBB" escape- '0x5c" /> would not be permitted, but 
<delimited field="0xAA" record="0xBB0xAA" escape="0x5c" /> would be fine. 
Note further that all delimiters may contain non-printable characters. 
Note: Only delimited files may be used by the product's LocalAggregator for reports and 

15 monitoring actions. 

Sub Elements: None 
destinations Element 

20 The destinations element, an optional sub element of serviceMonitor, demarcates the start 
and end of a block of information specifying the output mechanisms available to the 
filter. Output mechanisms currently supported are file (file system) and event (event 
log). (Note that while destinations is optional, it can only be removed if there are no 
output elements in the rules.xml file.) 

25 



Start Element 


End Element 


Attribute Required 


Attributes 


<destinations> 


</destinations> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

At least one of the following must be defined; multiple instances of each are allowed. 
30 <file> file specifies file system 

<event> event specifies event log 

div Element 

The div element, an optional sub element of fieldDefinition and condition, indicates the 
35 start and end of a block in which users can list expressions to be divided. The first 
expression will be divided by the second. 



Start Element 


End Element 


Attribute Required 


Attributes 


<div> 


</div> 


N/A 


(None) 



Attributes: None 
40 Sub Elements: 

May be used 0 or more times: 

<serverVariable> The serverVariable element indicates a server variable (e.g., HttpStatus, 

Duration, Timestamp) 
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<soapParameter> 


The 


soapParameter element indicates a parameter in the request 


<soapFault> 


The 


soapFault element indicates the error from the soap request 


<literal> 


The 


literal element indicates a constant value 


<field> 


The 


field element indicates a user-defined expression 


<rawData> 


The 


rawData element indicates that all information received in the 


request is to be logged. 







10 Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example divides the user-defined field named BigNumber by the user- 
defined field named SmallNumber, and returns the result: 

15 <div> 

<field name = "BigNumber" /> 
<field name="SmallNumber" /> 
</div> 

20 element Element 

element, an optional sub element used in expressions defined under fields, condition, and 
output, specifies the name of an xml element. 



Start Element 


End Element 


Attribute Required 


Attributes 


<element> 


</element> 


Yes 


name 






Yes 


direction 






No 


format 






No 


display-Name 






No 


type 



25 Attributes: 

name : 



30 



35 



40 



name, a required attribute, must consist of the combination of all ancestor elements in 
XPATH-compliant form, as described in the following examples: 

/ABC/DEF defines all sub elements <DEF> of <ABC> 
/ABC/DEF[2] defines the second sub element <DEF> of <ABC> 
/ABC/[1] defines the first sub element of <ABC> 

/ABC/DEF[2]/GHI selects all sub elements <GHI> of the second element named <DEF> 
of<ABC> 



direction: 

direction, a required attribute, indicates the direction (input or output) of the request in 
question. 

format : 
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format, an optional attribute, specifies the format of the header in question. Note that in 
this example, the format stringioo has previously been defined in the formats section. 

displayName : 

5 displayName, an optional attribute, is used only with delimited output to override the 

default name of the field with a name the user prefers. 

Example: <element name="/f oo/bar" direction="output" 

format="StringlOO" displayName="boo" /> 

type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
with the type information of the field. The GUI uses type to ascertain which fields are 
numeric (and thus whether they can be operated upon). If no type is specified, the filter 
1 5 will use the default value, "unknown". 

Example: <element name="/f oo/bar" directions "output" 

type= "String" > 

20 

Sub Elements: None 
encodeBase64 Element 

The encodeBase64 element, an optional sub element of transforms, indicates that the field 
25 should be encoded according to the base64 encoding definition. 



Start Element 


End Element 


Attribute Required 


Attributes 


<encodeBase64> 


</encodeBase64> 


N/A 


(None) 



Attributes: None 
Sub Elements: None 

30 

encodeXml Element 

The encodeXml element, an optional sub element of transforms, indicates that the field 
should be encoded according to xml encoding definition. Xml encoding means that any 
occurrence of the characters <"'&> will be replaced by < " &apos; & > 
35 respectively 



Start Element 


End Element 


Attribute Required 


Attributes 


< encodeXml > 


< /encodeXml > 


N/A 


(None) 



Attributes: None 
Sub Elements: None 

40 

encryption Element 

The encryption element, an optional sub element of transforms, indicates that this field 
should be encrypted using the given values for algorithm and keyFile, and should be 
outputted using the encoding defined in format. Note that in cases where several 

95 

3598784v 1 



CHS Ref. No.: SIS-00101 



transforms will be chained together, encryption must always be used last. (Later 
transforms could conceivably prevent decryption from being successful.) 



Start Element 


End Element 


Attribute Required 


Attributes 


<encryption> 


</encryption> 


No 


algorithm 






Yes 


keyFile 






No 


format 



Attributes: 

5 algorithm: 

algorithm, an optional attribute, indicates the algorithm with which the field should be 
encrypted. The only value currently valid is aes (default) . 

keyFile: 

10 keyFile, a required attribute, indicates the path to a file containing the key with which 

the encryption should take place. 

format : 

format, an optional attribute, defines the encoding in which the output should be 
15 formatted. The only value currently valid is base64 (default). 



20 



25 



30 



Example: <encryption algorithm="aes" keyFile="tickets -key" 

f ormat="base64" /> 

Sub Elements: None 

Note: The KeyFile must be created and must contain a valid encryption key before the 
configuration can successfully be loaded onto the module. It is recommended that access 
to the key file be restricted such that only the system administrator can write read and 
write it, and the web-server can read it. 

eq Element 

The eq element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list expressions to be compared for equality. 
This comparison can be performed on strings, numbers, or Boolean values. Note that if 
the types are not compatible, the operation will throw, and the entire condition will 
evaluate to false. 



Start Element 


End Element 


Attribute Required 


Attributes 


<eq> 


</eq> 


N/A 


(None) 



Attributes: None 
35 Sub Elements: 

May be used 0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 

40 <element> 

<soapOperation> 

<soapParameter> 

<soapFault> 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 
The element element indicates an xml element 
The soapOperation element indicates the name of the soap request 
The soapParameter element indicates a parameter in the request 
The soapFault element indicates the error from the soap request 
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<literal> The literal element indicates a constant value 

<field> The field element indicates a user-defined expression 

<rawData> The rawData element indicates that all information received in the 

request is to be logged. 

Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example compares the values of BytesSent and BytesReceived. If the 
values are the same, it returns a value of true: 

<eq> 

<serverVariable name="BytesSent" /> 
<serverVariable name= "BytesReceived" /> 
</eq> 

event Element 



The event element, an optional sub element of destinations, demarcates the start and end 
of a block of information specifying details about output to the event log subsystem. 



Start Element 


End Element 


Attribute Required 


Attributes 


< event > 


< /event > 


Yes 


name 






No 


enabled 






No 


severity 






No 


application 






No 


server 



Attributes: 

name : 

name, a required attribute, should be the name of the destination. 

Example: <event name="Eventlog" /> 

enabled: 

enabled, an optional attribute, specifies whether or not logging should be enabled to this 
destination. It defaults to true. 

Example: <event name= »Eventlog» enabled="true" /> 

severity: 

severity, an optional attribute, specifies what level the message should be logged. Valid 
options are Error, Warning, Information, AuditSuccess, and AuditFailure. 

Example: <event name="Eventlog" severity= "error" /> 

application: 

application, an optional attribute, is the name of the application that should appear in 
the event log. It defaults to "SiftLog". 

Example: <event name="Errorlog" application="testApp"> 

server: 

server, an optional attribute, is the name of the host where the events should be logged. 
If this option is omitted, events are logged locally. 

97 
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Example: <event name="Errorlog" server=""> 

Sub Elements: None 

5 Note: If event is configured to log to a different application, the user should install the 
SIFT message DLL as the event handler for that application. 

If the server attribute is set, the user should configure the domain so that the SBFTParser 
has the necessary permissions to log to that system. 

10 exists Element 



The exists element, an optional sub element of f ieldDef inition and condition, indicates 
that the expression it contains is defined in the message. 



Start Element 


End Element 


Attribute Required 


Attributes 


<exists> 


</exists> 


N/A 


(None) 



15 Attributes: None 
Sub Elements: 

May be used 0 or more 
<serverVariable> 
Duration, Timestamp) 

20 <header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 
25 <literal> 

<field> 

<rawData> 

request is to be logged. 
Other expressions (e.g, 

30 

Example: 

<exists> 

<xml name="http : //schemas . xmlsoap . org/soap/envelope/ : Envelope" direct ion= "output" 
jj </exists> 



field Element 

40 The field element, an optional sub element used in expressions defined under fields, 
condition, and output, is a reference to a fieldDefmition element. For instance, if you 



times: 

The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 
The element element indicates an xml element 
The soapOperation element indicates the name of the soap request 
The soapParameter element indicates a parameter in the request 
The soapFault element indicates the error from the soap request 
The literal element indicates a constant value 
The field element indicates a user-defined expression 
The rawData element indicates that all information received in the 

add, sub, mult. . .) may also be used as sub elements. 
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want to obtain a number that is the sum or difference of two expressions in a request, you 
can define an expression to obtain that result using fieldDefinition. You would refer to 
that element later using field. 



Start Element 


End Element 


Attribute Required 


Attributes 


<f ield> 


</field> 


Yes 


name 






No 


format 






No 


displayName 






No 


type 



10 



15 



Attributes: 

name : 



format : 



name, a required attribute, should be the name of the soapParameter in question. The 
parameter may refer to a component of a complex parameter (i.e. a data structure or an 
array). 



format, an optional attribute, specifies the format of the soapParameter in question. 
Note that in this example, the format stringioo has previously been defined in the 
formats section. 



20 



displayName: 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 



25 



30 



Example: 

type: 



< field name="TransaCtionId Value" format =• String 100" displayName="boo" /; 

type, an optional attribute, is used exclusively in delimited files to modify the header 
with the type information of the field. The GUI uses type to ascertain which fields are 
numeric (and thus whether they can be operated upon). If no type is specified, the filter 
will use the default value, "unknown". 



Example: 
Sub Elements: None 



<fieid name="TransactionId Value" type="int"> 



fieldDefinition Element 

35 The fieldDefinition element, an optional sub element of fields, indicates the start and end 
of a block in which users can define expressions that will be later used in either 
conditions or output. For instance, if you want to obtain a number that is the sum or 
difference of two expressions in a request, you can define an expression to obtain that 
result using fieldDefinition. You would refer to that element later using field. 

40 



Start Element 


End Element 


Attribute Required 


Attributes 


<f ieldDef inition> 


</f ieldDef inition> 


Yes 
No 


name 
type 
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Attributes: 

name : 



type: 



name, a required attribute, indicates the name of the field in question. This is specified as 
a string of characters enclosed in quotes. 



Example: 



<f ieldDef inition name="TotalBytes" > 



type, an optional attribute, is used by the GUI to "remember" what type the field should 
resolve to so that it will know whether it can be aggregated. The default value is "". 



Example: 

Sub Elements: 

May be used 0-1 times: 



<f ieldDef inition name="TotalBytes" type="int"> 





i nc 




ine 


<div> 


Ine 


'-•muii--* 


Ine 


<mod> 


ine 


•^eq^ 


ine 


<ne> 


The 


<lt> 


The 


<le> 


The 


<gt> 


The 


<ge> 


The 


<slt> 


The 


<sle> 


The 


<sgt> 


The 


<sge> 


The 


<match> 


The 


<and> 


The 


<or> 


The 


<not> 


The 


<exists> 


The 



fields Element 

The fields element, an optional sub element of serviceMonitor, indicates the start and end 
of a block in which users can define expressions to be used in either conditions or output. 



Start Element 


End Element 


Attribute Required 


Attributes 


<f ields> 


</t ields> 


N/A 


(None) 
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Attributes: None 
Sub Elements: 

May be used 0 or more times: 

<fieldDefinition> The fieldDefmition element is where custom 

expressions are defined. 

file Element 



The file element, an optional sub element of destinations, demarcates the start and end of 
a block of information specifying details about output to the file system. 



start Element 


End Element 


Attribute Required 


Attributes 


<f ile> 


</file> 


Yes 


name 






No 


enabled 






No 


autoFlush 






No 


buf ferSize 






No 


maxSize 



Attributes: 

name : 

name, a required attribute, should be the name of the destination in question. 
Example: <file name='"Errorlog"> 

enabled: 

enabled, an optional attribute, specifies whether or not logging should be enabled. It 
defaults to true. 

Example: <file name= ,, Errorlog" enabled=" false" > 

autoFlush: 

autoFlush, an optional attribute, specifies whether or not to flush the output on each 
write. It defaults to false. 

Example: <file name="Errorlog" autoFlush="true"> 

buf ferSize : 

The buf fersize element, an optional sub element of file, indicates the buffering size 
which the SIFT parser will use. Only values between -1 and 10 Meg are valid. 
bufferSize impacts the behavior of the file in the following way: 

• If the value is the default (-1), the SIFT parser will use the default 
buffering mechanism for the file writer. 

• If the value is 0, the SIFT parser will use no buffer. This is currently 
the same as having autoFlush turned off. (This will change in the 
future.) 

• If the value is any other positive integer (e.g., 64000), the SIFT parser 
will use that as the buffer for the writer. If there is no urgent need to 
retain all information if the server goes down, setting this to a larger 
number will ensure efficient writing. 

Example: <£ile name="ErrorlOg" bufferSize="64000"> 

maxSize: 
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maxSize IS the maximum size in megabytes that the log file should be allowed to reach. 
If the log reaches that limit, the rollover manager will either roll it over (if rollover is 
enabled) or rewind it to the beginning. The default value, 0, indicates that the file should 
not be rolled over because of size. Only positive integers are allowed. 

Example: <file name=*Errorlog" MaxSizes'l" > 

Sub Elements: 

May be used 0-1 times: 
1 0 <rollover> rollover specifies how the file should be rolled over 

<delimited> delimited indicates that the output file will contain delimiters between 

fields and records. 

formats Element 

15 The formats element, an optional sub element of serviceMonitor, is used to mark the start 
and end of a set of format definitions in an ODF file. Format definitions indicate how 
variables should be written to output devices. 



Start Element 


End Element 


Attribute Required 


Attributes 


< formats > 


</f ormats> 


N/A 


(None) 



20 Attributes: None 
Sub Elements: 

May be used 0 or more times: 

<string> The string element allows the user to define a string format for output. 

<timestamp> The timestamp element allows the user to define a time format for 

25 output. 

formatting Element 

The formatting element, an optional sub element of string, indicates how the given string 
should be encoded or otherwise transformed when it is written to the output device. 

30 



Start Element 


End Element 


Attribute Required 


Attributes 


<f ormatting> 


</f ormatting> 


No 


fieldWidth 






No 


maxLength 






No 


justify 



Attributes: 

fieldWidth: 

fieldwidth, an optional attribute, indicates the minimum number of spaces to allot for 
35 this field. This is specified as a positive integer, with 0 itself meaning no limit. The 

default value is 0. 

Example: formatting fieldWidth-' 100" /> 

40 maxLength : 
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maxLength, an optional attribute, indicates the maximum number of characters to print 
for this field. This is specified as a positive integer, with 0 itself meaning no limit. The 
default is 0. 

5 Example: formatting maxLength-' 100" /> 



justify: 

justify, an optional attribute, indicates how the data should be justified. Valid values 
are right and left. The default is left. 

10 

Example: formatting justify= w lef t" /> 



Sub Elements: None 
15 from Element 



The from element is a required sub element of replace. From takes a string that will be 
replaced with the contents of the to element when this is written to the output device 



Start Element 


End Element 


Attribute Required 


Attributes 


<f rom> 


</f rom> 


N/A 


(None) 



20 Attributes: None 
Sub Elements: None 

Valid values for this element include any string (Strings must be encoded to conform 
with the xml specification). Note that from must always be paired with to. The 
25 following example replaces the string "Rags" with the string "Riches": 

Example: <f rom>Rags<:/f rom> 

<to>Riches</to> 

ge Element 

30 The ge element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list numbers to be compared to see if one is 
greater than or equal to the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<ge> 


</ge> 


N/A 


(None) 



35 Attributes: None 
Sub Elements: 

May be used 0 or more times: 

<serverVariable> The serverVariable element indicates a server variable (e.g., HttpStatus, 

Duration, Timestamp) 

40 <header> The header element indicates an HTTP header (e.g., Host, Referrer) 
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10 



15 



<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 

request is to be logged. 



The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example compares the values of BytesSent and BytesReceived. If the 
former is greater than or equal to the latter, it returns a value of true: 

<ge> 

<serverVariable name="BytesSent" /> 
<serverVariable name= "BytesReceived" /> 
</ge> 



20 gt Element 

The gt element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list numbers to be compared to see if one is 
greater than the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<gt> 


</gt> 


N/A 


(None) 



25 



30 



35 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 

request is to be logged. 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 

The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



40 Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
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Example: 

The following example compares the values of BytesSent and BytesReceived. If the 
former is greater than the latter, it returns a value of true: 

<gt> 

5 <serverVariable name= "BytesSent" /> 

<serverVariable narae= "BytesReceived" /> 
</gt> 



10 hash Element 

The hash element, an optional sub element of transforms, indicates that this field should 
be hashed using the given value for algorithm, and should be outputted using the 



encoding defined in 1 


brmat. 


Start Element 


End Element 


Attribute Required 


Attributes 


<hash> 


</hash> 


No 


algorithm 






No 


format 



15 Attributes: 

Algorithm: 

Algorithm, an optional attribute, indicates the algorithm with which the field should be 
hashed. The only value currently valid is mds (default). 

20 Format : 

Format, an optional attribute, defines the encoding in which the output should be 
formatted. The only value currently valid is base64 (default). 

25 Example: <hash algorithm="md5" format="base64" /> 

Sub Elements: None 



header Element 



30 The header element, an optional sub element used in expressions defined under fields, 
condition, and output, specifies the name of an HTTP header. 



Start Element 


End Element 


Attribute Required 


Attributes 


<header> 


</header> 


Yes 


direction 






Yes 


name 






No 


format 






No 


displayName 






No 


type 



Attributes: 

35 direction: 

direction, a required attribute, indicates the direction (input or output) of the HTTP 
header in question. 



name : 

40 



name, a required attribute, indicates the name of the HTTP header in question. This is 
specified as a string of characters enclosed in quotes. 
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format : 

format, an optional attribute, specifies the format of the HTTP header in question. Note 
that in this example, the format stringioo has previously been defined in the formats 
section. 

5 

displayName: 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 

10 Example: <header directions "input" name="Uri" format="StringlOO" 

displayName="boo" /> 

type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
15 with the type information of the field. The GUI uses type to ascertain which fields are 

numeric (and thus whether they can be operated upon). If no type is specified, the filter 
will use the default value, "unknown". 



20 



Example: <header directions "input" name="Uri" type="String" /> 

Sub Elements: None 



le Element 

The le element, an optional sub element of fieldDefinition and condition, indicates the 
25 start and end of a block in which users can list numbers to be compared to see if one is 
less than or equal to the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<le> 


</le> 


N/A 


(None) 



Attributes: None 
30 Sub Elements: 

May be used 0 or more 
<serverVariable> 
Duration, Timestamp) 

<header> 
35 <element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 
40 <field> 

<rawData> 

request is to be logged. 

106 



times: 

The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 
The element element indicates an xml element 
The soapOperation element indicates the name of the soap request 
The soapParameter element indicates a parameter in the request 
The soapFault element indicates the error from the soap request 
The literal element indicates a constant value 
The field element indicates a user-defined expression 
The rawData element indicates that all information received in the 
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10 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example compares the values of BytesSent and BytesReceived. If the 
former is less than or equal to the latter, it returns a value of true: 

<le> 

<serverVariable name= "BytesSent" /> 
<serverVariable name="BytesReceived" /> 
</le> 

literal Element 

The literal element, an optional sub element used in expressions defined under fields, 
condition, and output, indicates a constant, specified within the elements. 



Start Element 


End Element 


Attribute Required 


Attributes 


<literal> 


</literal> 


N/A 


(None) 



15 



25 



Attributes: None 
Sub Elements: None 



Example: 

20 <literal>processing request from:</literal> 



Note that the contents within this element really are interpreted literally . \n, for instance, 
does not result in a carriage return, but prints literally as backslash n. 

logFlushlnterval Element 



logFlushlnterval, an optional sub element of configuration, indicates the number of 
seconds to wait before flushing all file destinations that do not have autoFlush turned on 
30 or a zero buffer size (i.e., file destinations that have buffering enabled). The purpose of 
this feature is to ensure that data does not remain in the stream buffer for more than 



Start Element 


End Element 


Attribute Required 


Attributes 


<logFlushInterval> 


</ logFlushlnterval > 


N/A 


(None) 



Attributes: None 
35 Sub Elements: None 

The value for logFlushlnterval can be any integer greater than or equal to 0, and should be enclosed 
directly in the element. If the element is not present, the product will default to a logFlushlnterval of 15 
seconds; if its value is 0, there will be no logFlushlnterval. 

40 Example: <logFlushmterval>5</logFlushInterval> 

It Element 



3598784vl 



107 



CHS Ref. No.: SIS-00101 



The It element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list numbers to be compared to see if one is 
less than the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<lt» 


</lt> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 



<serverVariable> 
Duration, Timestamp) 

<header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 
The element element indicates an xml element 
The soapOperation element indicates the name of the soap request 
The soapParameter element indicates a parameter in the request 
The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



request is to be logged. 
Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 

Example: 

The following example compares the values of BytesSent and BytesReceived. If the 

former is less than the latter, it returns a value of true: 
<it> 

< serverVariable name="BytesSent" /> 
< serverVariable name= "BytesReceived" /> 
</lt> 

match Element 

The match element, an optional sub element of fieldDefinition and condition, indicates 
the start and end of a block in which users can list perl regular expressions to see if they 
match. 



Start Element 


End Element 


Attribute Required 


Attributes 


<match> 


</match> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 

<serverVariable> The serverVariable element indicates a server variable (e.g., HttpStatus, 

Duration, Timestamp) 

<header> The header element indicates an HTTP header (e.g., Host, Referrer) 
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<element> 
<soapOperation> 
<soapParameter> 
<soapFault> 
5 <literal> 
<field> 
<rawData> 

request is to be logged. 

Other expressions (e.g, 

10 

Example: 

The following example compares the values of two fields to see if they match: 

<match> 

< field name=" , foo" /> 
15 <field name="*fo+$" /> 

</match> 

mod Element 

The mod element, an optional sub element of fieldDefinition and condition, indicates the 
20 start and end of a block in which users can list expressions to be divided. The first 
expression will be divided by the second, and the remainder returned. 



Start Element 


End Element 


Attribute Required 


Attributes 


<mod> 


</mod> 


N/A 


(None) 



Attributes: None 



25 Sub Elements: 

May be used 0 or more times: 





<serverVariable> 
Duration, Timestamp) 


The serverVariable element indicates a server variable (e.g., HttpStatus, 




<header> 


The header element indicates an HTTP header (e.g., Host, Referrer) 


30 


<element> 


The element element indicates an xml element 




<soapOperation> 


The soapOperation element indicates the name of the soap request 




<soapParameter> 


The soapParameter element indicates a parameter in the request 




<soapFault> 


The soapFault element indicates the error from the soap request 




<literal> 


The literal element indicates a constant value 


35 


<field> 


The field element indicates a user-defined expression 




<rawData> 

request is to be logged. 


The rawData element indicates that all information received in the 



Other expressions (e.g, add, sub, mult...) may also be used as sub elements. 
40 Example: 



The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 

add, sub, mult. . .) may also be used as sub elements. 
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The following example takes the user-defined field named BigNumber, divides it by the 
user-defined field named SmallNumber, and returns the remainder: 

<mod> 

<field name= "BigNumber" /> 
5 <field name= "SmallNumber" /> 

< /mod> 



mult Element 



10 The mult element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list expressions to be multiplied. 



Start Element 


End Element 


Attribute Required 


Attributes 


<mult> 


</mult> 


N/A 


(None) 



15 



20 



25 



30 



35 



40 



Attributes: None 
Sub Elements: 

0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 

request is to be logged. 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 

The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example multiplies the user-defined field named BigNumber by the user- 
defined field named SmallNumber, and returns the result: 

<mult> 

<field name="BigNumber" /> 
<field name="SmallNumber" /> 
</mult> 

ne Element 

The ne element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list expressions to be compared for inequality. 
The comparison can be performed on strings, numbers, or Boolean values. Note that if 
the types are not compatible, the operation will throw, and the entire condition will 
evaluate to false. 
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Start Element 


End Element 


Attribute Required 


Attributes 


<ne> 


</ne> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

5 May be used 0 or more times: 
May be used 0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 
1 0 <element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

15 <field> 

<rawData> 
request is to be logged. 

Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
20 Example: 

The following example compares the values of BytesSent and BytesReceived. If the 
values are different, it returns a value of true: 

<ne> 

<serverVariable name="BytesSent" /> 
25 <serverVariable name="BytesReceived" /> 

</ne> 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 
The element element indicates an xml element 
The soapOperation element indicates the name of the soap request 
The soapParameter element indicates a parameter in the request 
The soapFault element indicates the error from the soap request 
The literal element indicates a constant value 
The field element indicates a user-defined expression 
The rawData element indicates that all information received in the 



not Element 

30 The not element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list a condition which must not be true. 



Start Element 


End Element 


Attribute Required 


Attributes 


<not> 


</not> 


N/A 


(None) 



Attributes: None 
35 Sub Elements: 

May be used 0 or more times: 
May be used 0 or more times: 

<serverVariable> The serverVariable element indicates a server variable (e.g., HttpStatus, 

Duration, Timestamp) 

40 <header> The header element indicates an HTTP header (e.g., Host, Referrer) 

<element> The element element indicates an xml element 
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<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 

request is to be logged. 



The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
10 Example: 

The following example checks to make sure the value of foo is not true. If the condition 
is met, true is returned: 

<not> 

<field name="foo">true</f ield> 
15 </not> 



or Element 

The or element, an optional sub element of fieldDefmition and condition, indicates the 
20 start and end of a block in which users can list conditions, one of which must be met. 



Start Element 


End Element 


Attribute Required 


Attributes 


<or> 


</or> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

25 May be used 0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 

<element> 

30 <soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

35 <rawData> 

request is to be logged. 

Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

40 The following example checks to see if the value of foo or the value of bar is true. If one 
of these is true, the condition is met and true is returned: 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 

The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 
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<or> 

<field name="foo">true</f ield> 
<field name= "bar" ?true</field> 
</or> 



output Element 

The output element is a required sub element of rule. Each output must include a 
reference to a destination and one or more expressions for output The output will submit 
all expressions provided, in order, to the specified destination for processing. 



Start Element 


End Element 


Attribute Required 


Attributes 


< outputs 


< /outputs 


Yes 
No 


destination 
enabled 



Attributes: 

destination: 

destination, a required attribute, should be the destination where this output should be 
logged. 



enabled: 



enabled, an optional attribute, specifies whether or not logging should be enabled to this 
destination. It defaults to true. 



Example: 
Sub Elements: 

May be used 0 or more times: 



<output destinations "Eventlog" enabled="true" /> 



<serverVariable> 


The 


Duration, Timestamp) 




<header> 


The 


<element> 


The 


<soapOperation> 


The 


<soapParameter> 


The 


<soapFault> 


The 


<literal> 


The 


<field> 


The 


<rawData> 


The 


request is to be logged. 





The serverVariable element indicates a server variable (e.g., HttpStatus, 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
rawData Element 

The rawData element, an optional sub element used in expressions defined under fields, 
condition, and output, indicates that it will log all the data of specified kind that it sees on 
the wire. 
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Start Element 


End Element 


Attribute Required 


Attributes 


<rawData> 


</rawData> 


Yes 


kind 






Yes 


direction 






No 


format 






No 


displayName 






No 


type 



10 



15 



20 



30 



Attributes: 

direction: 

direction, a required attribute, indicates the direction (input or output) of the rawData in 
question. 

kind: 

kind, a required attribute, specifies the kind of the rawData in question. Valid options are 
headers and xml. 

format : 

format, an optional attribute, specifies the format of the rawData in question. Note that 
in this example, the format stringioo has previously been defined in the formats 
section. 

displayName : 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 



Example: <rawData direction="inpilt" kind="Xml" 

format=" StringlOO- di sp 1 ayName = " boo " > 
type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
25 with the type information of the field. The GUI uses type to ascertain which fields are 

numeric (and thus whether they can be operated upon). If no type is specified, the filter 
will use the default value, "unknown". 



Example: <rawData direction= "input" kind="xml" type= " String" > 

Sub Elements: None 
replace Element 

The replace element, an optional sub element of transforms, indicates that the string 
35 contained in its from sub element should be transformed to the string in its to sub element 
when written to the output device. Multiple replace elements are accepted in a transform. 



Start Element 


End Element 


Attribute Required 


Attributes 


<replace> 


</replace> 


N/A 


(None) 



Attributes: None 
40 Sub Elements: 

Must appear 1 time each: 

<from> The from element indicates the string to be replaced 

<to> The to element offers what should replace it 
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rollover Element 

The rollover element, an optional sub element of file, specifies where and when the log 
file should be rolled over. 

5 



Start Element 


End Element 


Attribute Required 


Attributes 


<rol lover > 


</rol lover > 


No 


startTime 






No 


interval 






No 


enabled 



Attributes: 



10 startTime: 

startTime represents the time, in seconds since EPOCH, from which the file rolling 
interval will be counted. If the startTime is in the future, rollover will not occur until 
this time; if it is in the past, rollover will occur on the next interval that is compatible 
with startTime. That is, if interval is every hour, and startTime specifies a 12:35 rollover 

1 5 time, rollover will occur every 60 minutes at 35 minutes past the hour. If the interval is 

not an exact multiple of hour, day, or week, then this parameter is ignored. The default 
value of 0 means it should be ignored. 

interval : 

20 interval represents the interval, in seconds, at which the file should be rolled. This 

should be a positive integer. 



enabled: 

25 Enabled indicates whether or not the rollover property is active. It defaults to true. 

Example: 

<rollover startTime="0" interval="86400" enabled="true"/> 

30 Sub Elements: 

May use 0-1 times: 

<copies> Copies indicates what should happen to rolled over log files. 



35 rule Element 



The rule element, a required sub element of serviceMonitor, indicates what, where, and 
when to log. Each rule may have 0 or 1 conditions. 



Start Element 


End Element 


Attribute Required 


Attributes 


<rule> 


</rule> 


Yes 
No 


name 
enabled 



40 Attributes: 

name: 

name, a required attribute, should be the name of the rule in question, 
enabled : 
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enabled, an optional attribute, specifies whether or not logging should be enabled to this 
destination. It defaults to true. 

Example: <rule name= "Errorlogger" enabled="true" /> 

5 

Sub Elements: 

May use 0-1 of the following: 

<condition> The condition must be true for output to be produced. 

10 May use 0 or more of the following: 

<output> Output defines an individual output specification. 

sampling Element 

Sampling, an optional sub element of configuration, indicates the frequency with which 
15 operations should be sampled. For instance, in cases where performing requested 

operations every time might bog down the server, sampling can be used to request that 
data be sampled only every Nth occurrence. The default value for sampling is 1, 
indicating that every request should be evaluated. 



Start Element 


End Element 


Attribute Required 


Attributes 


<sampling> 


</sampling> 


N/A 


(None) 



20 

Attributes: None 
Sub Elements: None 

The value for sampling can be any integer greater than 0, and should be enclosed directly in the element. 

25 

Example: <sampling>5</sampling> 

serverVariable Element 

The serverVariable element, an optional sub element used in expressions defined under 
30 fields, condition, and output, specifies the name of a server variable. 



Start Element 


End Element 


Attribute Required 


Attributes 


<serverVariable> 


</serverVariable> 


Yes 


name 






No 


format 






No 


displayName 






No 


type 



Attributes: 

name: 

35 name, a required attribute, indicates the name of the serverVariable in question. This is 

specified as a string of characters enclosed in quotes. Acceptable values are: 

©clienthostname 

©clientusername 

©servername 
40 ©httpoperation 

©uri 
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©uriparameters 
©status 
©localstatus 
©bytessent 
5 ©bytesreceived 

©duration 
©timestamp 
©hostname 

10 format : 

format, an optional attribute, specifies the format of the serverVariable in question. 
Note that in this example, the format stringioo has previously been defined in the 
formats section. 

15 displayName: 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 



Example: <serverVariable name="BytesSent" f ormat="StringlOO" 

20 displayName="boo" > 

type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
with the type information of the field. The GUI uses type to ascertain which fields are 
25 numeric (and thus whether they can be operated upon). If no type is specified, the filter 

will use the default value, "unknown". 



Example: <serverVariable name="BytesSent" type="int"> 

30 

Sub Elements: None 



serviceMonitor Element 



The serviceMonitor element is required in every ODF file. It is used to indicate the start 
35 and end of the file. 



Start Element 


End Element 


Attribute Required 


Attributes 


<serviceMonitor> 


c/serviceMonitor> 


Yes 


revision 






Yes 


version 






No 


enabled 



Namespace: 

40 http: //www. serviceintegritv ■ com/serviceMonitor/rulesDef inition. xml 



Attributes: 

revision: 

revision, a required attribute, indicates the version of the configuration. This is 
45 specified as a positive integer enclosed in quotes. The revision number should be 

incremented every time any change is made to the configuration. 

version: 

version, a required attribute, refers to the version of the SIFT code. The value of this 
50 attribute must be "1" for version 1 of SIFT; the parser will ignore configurations with 

version numbers that do not match its own.). 

Example: <serviceMonitor revision="22" version="l"> 
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enabled: 

enabled, an optional attribute, shows whether or not the configuration is enabled. This is 
specified as true or false. The default value is true. 

Example: oerviceMonitor xmlns= 

"http://www.serviceintegrity.com/serviceMonitor/rulesDefinition.xml" revision="23" 
version="l" enabled="f alse" > 



Sub Elements: 

May be used 0-1 times: 
<configuration> 

<formats> 

<fields> 

<destinations> 



configuration dictates the behavior of the service 
formats shows how variables should be written to output devices 
fields enable users to define expressions in conditions or output 
destinations specify the device for data output 



May be used 0 or more times: 

<ruie> rule defines what, where, and when to log 

sge Element 

The sge element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list strings to be compared to see if one is 
greater than or equal to the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<sge> 


</sge> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 



<serverVariable> 


The 


Duration, Timestamp) 




<header> 


The 


<element> 


The 


<soapOperation> 


The 


<soapParameter> 


The 


<soapFault> 


The 


<literal> 


The 


<field> 


The 


<rawData> 


The 


request is to be logged. 





The serverVariable element indicates a server variable (e.g., HttpStatus, 



Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
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Example: 

The following example compares the values of Host and Referrer lexically. If the former 
is greater than or equal to the latter, it returns a value of true: 

<sge> 

<Header name="Host" /> 
<Header name= "Referrer" /> 
</sge> 

sgt Element 

The sgt element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list strings to be compared to see if one is 
greater than the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<sgt> 


</sgt> 


N/A 


(None) 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 
request is to be logged. 

Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 
The element element indicates an xml element 
The soapOperation element indicates the name of the soap request 
The soapParameter element indicates a parameter in the request 
The soapFault element indicates the error from the soap request 
The literal element indicates a constant value 
The field element indicates a user-defined expression 
The rawData element indicates that all information received in the 



Example: 

The following example compares the values of Host and Referrer lexically. If the former 
is greater than the latter, it returns a value of true: 

<sgt> 

<Header name="Host" /> 
<Header name="Referrer" /> 
</sgt> 

singleLine Element 

The singleLine element, an optional sub element of transforms, indicates that all new 
lines in the field should be replaced with spaces when written to the output device. 



Start Element 


End Element 


Attribute Required 


Attributes 


<singleLine> 


</singleLine> 


N/A 


(None) 
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Attributes: None 
Sub Elements: None 

sle Element 

The sle element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list strings to be compared to see if one is less 
than or equal to the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<sle> 


</sle> 


N/A 


(None) 



10 



15 



20 



Attributes: None 
Sub Elements: 

May be used 0 or more times: 
<serverVariable> 
Duration, Timestamp) 

<header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 

request is to be logged. 



The serverVariable element indicates a server variable (e.g., HttpStatus, 

The header element indicates an HTTP header (e.g., Host, Referrer) 

The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



25 Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example compares the values of Host and Referrer lexically. If the former 
is less than or equal to the latter, it returns a value of true: 

30 <sle> 

<Header name="Host" /> 
<Header name= "Referrer" /> 
</sle> 

35 sit Element 

The sit element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list strings to be compared to see if one is less 
than the other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<slt> 


</slt> 


N/A 


(None) 
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Attributes: None 
Sub Elements: 

May be used 0 or more times: 



5 


<serverVariable> 
Duration, Timestamp) 


The serverVariable element indicates a server variable (e.g., HttpStatus, 




<header> 


The header element indicates an HTTP header (e.g., Host, Referrer) 




<element> 


The element element indicates an xml element 




<soapOperation> 


The soapOperation element indicates the name of the soap request 




<soapParameter> 


The soapParameter element indicates a parameter in the request 


10 


<soapFault> 


The soapFault element indicates the error from the soap request 




<literal> 


The literal element indicates a constant value 




<field> 


The field element indicates a user-defined expression 




<rawData> 

request is to be logged. 


The rawData element indicates that all information received in the 



15 Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 



Example: 

The following example compares the values of Host and Referrer lexically. If the former 
is less than the latter, it returns a value of true. (Host is less than Referrer because it 
20 occurs first in the alphabet): 

<slt> 

<Header name="Host" /> 
<Header name="Ref errer" /> 
</slt> 

25 

soapFault Element 

The soapFault element, an optional sub element used in expressions defined under fields, 
condition, and output, specifies the error from the soap request. 



Start Element 


End Element 


Attribute Required 


Attributes 


<soapFault> 


</soapFault> 


Yes 


name 






No 


format 






No 


displayName 






No 


type 



30 



Attributes: 

name : 

name, a required attribute, should be the name of the soapFault in question. This should 
be specified in XPATH-compliant form, as described in the following examples. (Note 
35 that if you do not wish to print the name of the soapFault, you can simply enter ""): 

1. /ABC/DEF defines all sub elements <DEF> of <ABC> 

2. /ABC/DEF[2] defines the second sub element <DEF> of <ABC> 

3. /ABC/[l] defines the first sub element of <ABC> 
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4./ABC/DEF[2]/GHI selects all sub elements <GHI> of the second element named <DEF> 
of<ABC> 

format : 

format, an optional attribute, specifies the format of the soapFauit in question. Note 
that in this example, the format stringioo has previously been defined in the formats 
section. 

displayName: 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 

Example: <soa P Fauit name="/foo/bar" 

format= "Stringl 00" displayName="boo"/> 

type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
with the type information of the field. The GUI uses type to ascertain which fields are 
numeric (and thus whether they can be operated upon). If no type is specified, the filter 
will use the default value, "unknown". 

Example: <soa P Fauit name="/foo/bar" type= "string" > 



Sub Elements: None 
soapOperation Element 



The soapOperation element, an optional sub element used in expressions defined under 
fields, condition, and output, specifies the name of the soap request. 



Start Element 


End Element 


Attribute Required 


Attributes 


< soapOperat ion> 


</ soapOperat ion> 


No 


format 






No 


displayName 






No 


type 



Attributes: 

format : 

format, an optional attribute, specifies the format of the soapOperation in question. 
Note that in the following example, the format stringioo has previously been defined in 
the formats section. 

displayName: 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 

Example: <soapOperation. format="Stl*inglOO" displayName="boo" /> 

type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
with the type information of the field. The GUI uses type to ascertain which fields are 
numeric (and thus whether they can be operated upon). If no type is specified, the filter 
will use the default value, "unknown". 

Example: < soapOperat ion type= "String" > 
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Sub Elements: None 
Example: 

In an output operation, the following would print the name of the value of soapOperation 
to the output device. 

< soapOperation /> 

soapParameter Element 



The soapParameter element, an optional sub element used in expressions defined under 
fields, condition, and output, specifies the name of a parameter in the soap request. 



Start Element 


End Element 


Attribute Required 


Attributes 


< soapParameter > 


</soapParameter> 


Yes 


name 






Yes 


direction 






No 


format 






No 


displayName 






No 


type 



Attributes: 

name : 

name, a required attribute, should be the name of the soapParameter in question. The 
parameter may refer to a component of a complex parameter, such as a data structure or 
an array. It should be specified in XPATH-compliant form, as described in the following 
examples: 

1. /ABC/DEF defines all sub elements <DEF> of <ABC> 

2. /ABC/DEF[2] defines the second sub element <DEF> of <ABC> 

3. /ABC/[l] defines the first sub element of <ABC> 

/ABC/DEF[2]/GHI selects all sub elements <GHI> of the second element named <DEF> 
of<ABC 

direction: 

direction, a required attribute, indicates the direction (input or output) of the 
soapParameter in question. 

format : 

format, an optional attribute, specifies the format of the soapParameter in question. 
Note that in this example, the format stringioo has previously been defined in the 
formats section. 

displayName : 

displayName, an optional attribute, is used only with delimited output to override the 
default name of the field with a name the user prefers. 

Examples: 

< soapParameter name= "TransactionldW alue- direction= "input" 
format = " String 100" displayName="boo" /> 
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<soapParameter name="/TransactionId/Value[3]" direction="output" 
format="StringlOO" displayName="boo" /> 

<soapParameter name="/TransactionId/Value[@type=mt]" direction="input" 
format="StringlOO" displayName="boo" /> 

5 type: 

type, an optional attribute, is used exclusively in delimited files to modify the header 
with the type information of the field. The GUI uses type to ascertain which fields are 
numeric (and thus whether they can be operated upon). If no type is specified, the filter 
will use the default value, "unknown". 

0 

Example: < soapParamet er name= "Transactionld/V alue" 

direct ion=" input" type="int"> 



Sub Elements: None 

15 



string Element 



The string element, a sub element of formats, specifies the formatting that should be used 
when a string is written to the output device. 
20 ' ' 



Start Element 


End Element 


Attribute Required 


Attributes 


<string> 


</string> 


No 


name 



Attributes: 

Name: 

Name, a required attribute, indicates the name of the format. This is specified as a string 
25 of characters enclosed in quotes. 

Example: <string name="MyString"> 

Sub Elements: 

May use 0-1 of the following: 
30 <transforms> The transforms element specifies how the string will be 

encoded/changed. 

<formatting> The formatting element allows the user to specify the string's output 

format. 

sub Element 

35 The sub element, an optional sub element of fieldDefinition and condition, indicates the 
start and end of a block in which users can list expressions to be subtracted from each 
other. 



Start Element 


End Element 


Attribute Required 


Attributes 


<aub> 


</sub> 


N/A 


(None) 



40 Attributes: None 
Sub Elements: 

May be used 0 or more times: 

<serverVariable> The serverVariable element indicates a server variable (e.g., HttpStatus, 

Duration, Timestamp) 



124 



3598784vl 



CHS Ref. No.: SIS-00101 



<header> 

<element> 

<soapOperation> 

<soapParameter> 

<soapFault> 

<literal> 

<field> 

<rawData> 

request is to be logged. 



The header element indicates an HTTP header (e.g., Host, Referrer) 

The element element indicates an xml element 

The soapOperation element indicates the name of the soap request 

The soapParameter element indicates a parameter in the request 

The soapFault element indicates the error from the soap request 

The literal element indicates a constant value 

The field element indicates a user-defined expression 

The rawData element indicates that all information received in the 



10 Other expressions (e.g, add, sub, mult. . .) may also be used as sub elements. 
Example: 

The following example subtracts the server variable named BytesReceived from the 
server variable named BytesSent, and returns the result: 

15 <sut» 

oerverVariable name= "BytesSent" /> 
<serverVariable name= "BytesReceived" /> 
</sub> 

20 timestamp Element 

The timestamp element, a sub element of formats, specifies a format that can be used 
when the timestamp is written to the output device. 



Start Element 


End Element 


Attribute Required 


Attributes 


<timestamp> 


</timestamp> 


No 


name 



25 



Attributes: 

Name: 



Name, a required attribute, indicates the name of the timestamp in question. This is 
specified as a string of characters enclosed in quotes. 



30 



Example: 



<timestamp name="TimeAf terTime" > 



Sub Elements: None 

35 The timestamp format requires an integer that specifies time as the number of 

milliseconds since EPOCH (Jan 1, 1970 GMT). The output definition below uses a 
modified version of the format specification defined by the strftime() system call, where 
%Y is equivalent to a 4 digit year, etc. In this case, %L represents milliseconds. 

Example: <tlmestamp name="TimefOrmat">%Y-%m-%d 

40 %H:%M:%S.%L</timestamp> 

to Element 
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The to element, a required sub element of replace, identifies a string with which to 
replace the string specified by the from element when written to the output device. 



Start Element 


End Element 


Attribute Required 


Attributes 


<to> 


</to> 


N/A 


(None) 



5 Attributes: None 
Sub Elements: None 

Valid values for this element include any string. Note that it must be paired with the 
from element. The following example replaces the string "Rags" with the string 
10 "Riches": 

Example: <f rom>Rags</f rom> 

<to>Riches</to> 

transforms Element 

15 The transforms element, an optional sub element of string, indicates how the given string 
should be encoded or otherwise transformed when it is written to the output device. All 
sub elements will be evaluated in the order in which they are defined to produce the 
output. 



Start Element 


End Element 


Attribute Required 


Attributes 


<transf orms? 


</transforms> 


N/A 


(None) 



20 

Attributes: None 
SubElements: 

May use 0-1 times: 

<encryption> The encryption element encrypts the field with the given information. Note that 

25 in cases where several transforms will be chained together, encryption must always be used last. 

(Otherwise, later transforms could conceivably prevent decryption from being successful.) 

<singleLine> The singleLine element replaces new lines with spaces 

<encodeXml> The encodeXml element encodes according to the xml encoding definition 

<encodeBase64> The encodeXml element encodes according to the base64 encoding definition. 

30 <trim> Trim causes the formatted string to be trimmed of leading and trailing white 

space. 

<hash> hash uses md5 to hash the field. 

May use 0 or more times: 
35 <replace> The replace element replaces one string with another 
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trim Element 



The trim element, an optional sub element of transforms, causes the formatted string to be 
trimmed of leading and trailing white space (including " ", "\t", "\n"). 



Start Element 


End Element 


Attribute Required 


Attributes 


<trim> 


</trim> 


N/A 


(None) 



Attributes: None 
SubElements: None 
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